summaryrefslogtreecommitdiffstats
path: root/drivers/isdn/i4l
diff options
context:
space:
mode:
authorEric Sesterhenn <snakebyte@gmx.de>2006-05-21 00:00:12 +0200
committerLinus Torvalds <torvalds@g5.osdl.org>2006-05-21 21:59:18 +0200
commita6a61c5494145c904bead0cceadd94080bd3a784 (patch)
tree7b0af71fd46a86da830c1ae3c0391fa9e55dee53 /drivers/isdn/i4l
parent[PATCH] cpuset: might_sleep_if check in cpuset_zones_allowed (diff)
downloadlinux-a6a61c5494145c904bead0cceadd94080bd3a784.tar.xz
linux-a6a61c5494145c904bead0cceadd94080bd3a784.zip
[PATCH] Overrun in isdn_tty.c
This fixes coverity bug id #1237. After the while loop, it is possible for i == ISDN_LMSNLEN. If this happens the terminating '\0' is written after the end of the array. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Cc: Karsten Keil <kkeil@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/isdn/i4l')
-rw-r--r--drivers/isdn/i4l/isdn_tty.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 3585fb1f3344..2ac90242d263 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -2880,7 +2880,7 @@ isdn_tty_cmd_ATand(char **p, modem_info * info)
p[0]++;
i = 0;
while (*p[0] && (strchr("0123456789,-*[]?;", *p[0])) &&
- (i < ISDN_LMSNLEN))
+ (i < ISDN_LMSNLEN - 1))
m->lmsn[i++] = *p[0]++;
m->lmsn[i] = '\0';
break;